Suspected Data Theft by an Employee? First Steps

When someone leaves and there is a suspicion they took client lists, designs or source code with them, what you do in the first hours determines whether you end up with something usable or just a strong feeling. The difficulty is that the normal, sensible IT response — check the machine, reset the account, wipe and reissue the laptop — is close to the worst thing to do if the matter might ever be argued formally.

Take the device out of use and leave it as it is. Do not log in to look around, do not run searches across it, and do not let IT reimage it for the next employee. Simply browsing a file system updates access times, and reimaging destroys the evidence entirely. Store it somewhere with restricted access and write down who has had it and when.

Every interaction with a live system changes it. Opening a folder, previewing a document or plugging the drive into another machine can alter metadata that would otherwise have shown when a file was last accessed or copied. Where the question is precisely whether a file was copied on a particular date, altering that metadata weakens or removes the answer. An image is taken first, and the analysis happens on the image, so the original stays as it was.

This one is counter-intuitive. Disabling or deleting an account can remove access to mailbox contents, cloud file history and audit logs that are more informative than the laptop itself. Where there is an active risk of further exfiltration, containment obviously comes first. Where there is not, it is worth preserving the account and its data before changing anything, and taking advice on the order.

Most of the useful evidence in these cases lives in logs with short retention: VPN and remote access records, cloud storage audit logs, email sending history, badge or door entry records, and endpoint telemetry. Many of these keep only weeks by default. Identify and export them early, because they cannot be recovered once the retention window passes, however good the eventual analysis is.

Common findings include USB devices connected and when, files copied to removable media or cloud services, large uploads to personal accounts, mass downloads shortly before resignation, and files deleted in a hurry. What can be shown depends on the systems in use and what logging existed at the time. Being told honestly what cannot be determined matters as much as what can, particularly if the matter proceeds.

If there is any prospect of a dispute, a claim or a regulator asking questions, handling matters as much as findings. That means images with verified hashes, a documented chain of custody, and analysis that another examiner could repeat and reach the same conclusion from. Work done informally on the original device, without that discipline, may be perfectly accurate and still carry little weight later.

Employment, privacy and data protection rules vary by jurisdiction and affect what you may examine, particularly on personal devices or personal accounts. We are not lawyers and do not give legal advice. Talk to your legal adviser alongside any technical work, and where you need evidence preserved before decisions are made, preservation can begin while that advice is being sought.